Store birth date in systemd for age verification

(github.com)

37 points | by sadeshmukh 9 hours ago

17 comments

  • JellyYelly 6 hours ago
    I don't mean to come across as a snob, or anything like that, but I find this PR really odd.

    It's the authors first time contributing to this repo and it the feedback on the PR that was addressed is really odd, like some of it is super basic stuff, even if you're not familiar with the code base or the language.

    Just an all round weird vibe.

    • mock-possum 2 hours ago
      > “The clang-tidy test failures appear to be pre-existing and don't seem to be related to my code”

      I’ve seen Claude reproduce nearly identical comments, wonder if that’s a couidence

  • miohtama 7 hours ago
    This should be the time for open-source developers to use their common sense to decide whether we should push back.

    If California wants to create its own Protect the children operating system, it should bear the cost and responsibility for this alone, and not export any of the sketchy political agenda to the wider open source community.

    • bitwize 2 hours ago
      It's the law. If you live in the United States, and a minor in California uses your OS that didn't check age, you could be liable for up to $2500 per occurrence. That can add up quickly if California schoolkids discover your OS does an end run around the law. When ruin is the alternative, compliance becomes non-negotiable.
      • iamnothere 2 hours ago
        Many distros disagree and are not complying. It’s very likely that this (and all similar bills) will be overturned after legal challenges. Noncommercial projects especially have a strong 1A case and we have already beaten one of these bills. Keep fighting.
      • aleph_minus_one 2 hours ago
        > It's the law

        "There is no justice in following unjust laws." - Aaron Swartz (Guerilla Open Access Manifesto)

        • miohtama 58 minutes ago
          Nobody in their right mind can explain how locking down operating systems will protect children. It does not make sense. This is just another way to sneak in more mass surveillance and kill anonymous online presence, with most ridiculous excuses.
      • nvme0n1p1 2 hours ago
        California laws apply to people living in California. Not the whole country.
      • calvinmorrison 1 hour ago
        At some point you have to pick a jurisdiction. It's impossible to support all jurisdictions laws as a company, much less as a FOSS project.
      • josefritzishere 2 hours ago
        California can't govern outside California. Other states have discovered the legal limits of their soverignty quite recently. But it certainly argues against hosting in CA and furthermore, consulting an attorney.
        • bitwize 1 minute ago
          If you have a connection to California, you can be sued in their courts. I don't know whether providing (not selling, that certainly counts) an OS to California residents from outside California counts as a connection, that's something you need to review with your legal team. One thing is certain though: you need legal counsel to do OS dev; the Terry Davis era has come to a close.
  • dirtikiti 1 hour ago
    "protecting" children by providing specific ages to data harvesters.

    as per usual, liberal policy doing the exact opposite thing they claim it does.

    • tylerritchie 1 hour ago
      for the california legislation there were no "nay" votes. it's disapointing this performatively protective stance permeates both dominant right-of-global-center parties in America, but it is "all of them"
    • burnt-resistor 1 hour ago
      It's not a liberal policy, it's an illiberal one bending the knee to feudal techbros.
  • jprjr_ 3 hours ago
    I cannot express how disappointed I am to see open source projects giving in to complying with age attestation laws.

    I feel like complying really undermines any first amendment arguments. Software is a first amendment protected form of expression, giving in before getting any actual threats from the state makes your participation seem voluntary.

    Systemd's participation puts the entire world into compliance with a California law

    • iamnothere 2 hours ago
      BSDs don’t use SystemD, neither do some distros. After they have been exposed here as collaborators I suspect we will see freedom-respecting distros move away from them. I myself have been neutral to weakly positive on SystemD until now, as they put forward some decent solutions to longstanding problems, but from now on I intend to stop using their software entirely.

      As it turns out, the people who warned against “professionalizing” and corporatizing Linux were correct.

      • burnt-resistor 1 hour ago
        Just to be clear and specific, formal engineering processes and corporate selling out are two orthogonal properties that should never be conflated. Stuff millions of people use shouldn't be slapped together as a "hobby" without careful testing and change control processes. It also should get sufficient (crowd)funding so it can get the attention it deserves.
    • zeratax 2 hours ago
      this is not attestation though? it's just parental controls, no?
    • burnt-resistor 1 hour ago
      Techbros gonna techbro... bending the knee to fascists and privacy traitors. The next law will groom something else and eventually it will be tech requiring digital identification and approval to use the internet.
  • mzajc 3 hours ago
    Tangentially related, but does anyone know what Poettering's "cryptographically verifiable integrity" endeavor[0] is about yet?

    [0]: https://news.ycombinator.com/item?id=46784572

    • rcxdude 2 hours ago
      Probably what it says on the tin, TBH. If you hold the keys, it can strengthen security a lot.
  • nazgulsenpai 1 hour ago
    Will unincorporated distros who don't comply be illegal to use in the areas passing these laws? This isn't "obscenity" -- isn't there a first amendment argument for these projects?
  • bravetraveler 4 hours ago
    Where can I drop a file to always return 1969
    • chainingsolid 3 hours ago
      I was thinking 1984, or if I can return a float, NaN.
      • bravetraveler 2 hours ago
        Sure, not picky. A symlink to /dev/null for "I'm a grown-up/own this device" would be acceptable. Assumed one would put whatever value they wanted in the INI file :)
    • aleph_minus_one 1 hour ago
      > Where can I drop a file to always return 1969

      I am out of the loop: what is so special about 1969 concerning age verification?

      • bravetraveler 1 hour ago
        I doubt I can do the observation justice, my mind went there thinking 'a moment before the Unix Epoch' and the more... well-traveled meme: 'haha funny number [dropping the leading 19]'. Any number would've worked just as well, it's not significant. I really just wanted to express my participation in this, if at all, likely won't be in good faith.

        That said... an option for 'I could have declared an age/birth date but chose not to' seems preferable. I was talking about poisoning but this could be more productive. Any attestation would reasonably fail, sure, but it sends a potentially-meaningful signal [to someone].

        • aleph_minus_one 1 hour ago
          > 'a moment before the Unix Epoch'

          OK, "I am so old that already lived before the UNIX epoch even started" (or a year which breaks systems that cannot handle times before the UNIX epoch) sounds plausible. :-)

          • bravetraveler 1 hour ago
            Fairly context dependent, however :) This attestation/verification topic (and 1969, presumably) keeps appearing in places where I doubt The Epoch is relevant!
    • renewiltord 2 hours ago
      It’s admin settable. So just sudo homectl it. You are presumably admin.
      • bravetraveler 2 hours ago
        That's beside my 'point', but fine. I'm deliberately conflating things for humor, sorry it missed. I'll get serious/stop joking around. I have no interest in administrating this. Especially on a per-user basis (despite that being the only way this 'works', I'm generally opposed). I'd prefer a file to drop in /etc... like one would express preferences over, say, /usr.

        It's entirely optional, I get that. I could 'just' not set anything. Spare your fingers. I want to poison it [or loudly opt out] without a lot of effort. This includes running N commands when a file to could effectively disable the signal.

        Said differently: I don't want to configure the portal, I want to ~~break~~ mask it.

        • SAI_Peregrinus 22 minutes ago
          Stick a service unit in `/etc/systemd/system/` that is a oneshot type with `WantedBy=multi-user.target`, and which runs the appropriate homectl command for each user listed in /etc/passwd (likely just in a shell script).
  • zoobab 2 hours ago
    Instead of protesting, large corporations decided to ploy.

    They cannot loose markets, like California or Brazil.

  • petee 3 hours ago
    I had to check the date; is not April yet
  • noobermin 4 hours ago
    The context is that this is in response to California in the US potentially passing a law that requires age verification on the operating system level.
    • iAMkenough 2 hours ago
      Traced back to Meta lobbyists. https://tboteproject.com/
    • zeratax 2 hours ago
      there is no verification happening though
      • iamnothere 2 hours ago
        There is in New York, Brazil, and probably other places too. Attestation is a foot in the door and will become verification when it is shown to be ineffective. And unless the law is defeated, it will provide precedent for further legislative intrusion into personal computing.
      • treesknees 2 hours ago
        Because systemd isn’t an operating system. It’s just providing a mechanism for the OS to store/lookup the user’s birthday. It’s up to individual distros to do the verification (should the law stand and OS vendors choose to comply)
  • anotherhadi 5 hours ago
    Pretty good implementation imo
    • Spivak 2 hours ago
      Yeah, it's the most basic thing you could do that's not intrusive to the rest of the system. userdb is a local directory and most directories, like LDAP, have a DoB field. Even if these laws fizzle out the change would still be potentially useful for other things like parental controls apps.
  • icar 5 hours ago
    Having this in userdb is not bad per se. We already have a bunch of PII in there.
    • stuaxo 4 hours ago
      I like the analogy of data as oil: polluting when it gets out.

      I'd like to severely limit the amount of PII on the system.

  • calvinmorrison 1 hour ago
    This should fit lennarts hubris well.

    This developer should be blacklisted from all open source projects, permanently.

  • flykespice 1 hour ago
    It's scary how much global surveillance is closing in to become a reality with states passing these lesgilations, in the name of "protecting children", but it just serves to collect citizent personal data...

    And now they are creeping into open source projects too. What once was thought as the bastion of absolute freedom from the state

    • aleph_minus_one 1 hour ago
      > and now it's creeping into open source projects too. What once was thought as the bastion of absolute freedom from the state

      It is indeed scary is how compliant the open-source projects have become to the "governmental overlords". Where has the hacker spirit gone?

  • jmclnx 2 hours ago
    Interesting solution and I really expected systemd would be were this age validation would be placed if distros what it.

    But if this becomes a thing in Linux for the distro I use (doubtful), I will abandon Linux after 30+ years.

    I am rather confident OpenBSD will ignore this law and I expect other BSDs will to. If not, back to DOS :)

    Note, I have a BSD on a coupld of old laptops for testing reasons. I test what I write in the BSDs to help find issues, that works well.

  • bibimsz 2 hours ago
    i dont like this
  • bmlzootown 3 hours ago
    This is absolutely ridiculous.